CVE-2026-114245
Deferred Deferred - Pending Action

Improper Authorization in Insurance Management System via Admin Registration

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: VulDB

Description
A weakness has been identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected by this issue is some unknown functionality of the file /Admin/includes/Admin-Register-inc.php of the component Add New Admin Form. Executing a manipulation of the argument submit/Admin_id/password can lead to improper authorization. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-21
Last Modified
2026-10-21
Generated
2026-11-10
AI Q&A
2026-10-21
EPSS Evaluated
2026-11-09
NVD
CVE-2026-114245
EUVD
EUVD-2026-107253

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183
dhikshitha29 Insurance-Management-System 125362cc21dca20d74091a4913a5096bb58dd837

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a missing authentication check in the Insurance Management System. The file Admin/includes/Admin-Register-inc.php allows unauthenticated users to create administrator accounts by sending crafted POST requests without proper authorization verification. Attackers can set a password and gain full admin privileges.

Detection Guidance

Check for unauthorized admin account creation by monitoring POST requests to /Admin/includes/Admin-Register-inc.php. Look for unexpected admin accounts in the database. Inspect server logs for suspicious access to the registration endpoint without prior authentication.

Impact Analysis

An attacker could exploit this to create an admin account and gain full control over the system. This includes accessing sensitive data, modifying records, and performing unauthorized actions. The exploit is publicly available and can be used remotely.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Immediately restrict access to /Admin/includes/Admin-Register-inc.php by implementing authentication checks. Review and remove any unauthorized admin accounts. Apply input validation and enforce session-based access controls for admin functions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-114245. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...